You will need the two sets of users to be mapped to different Splunk roles. You can find the roles configuration in Manager under Access Control. You can either: Create multiple dashboards with the appropriate permissions Create the dashboard with saved searches, and set the permissions between the two sets of saved searches to be appropriate If the searches are from different data sets, you could apply a masking search filter to the other users in their role ... View more

They are in the individual TAs for each of the different kinds of monitored servers. So for example $SPLUNK_HOME/etc/apps/Splunk_for_ActiveDirectory/appserver/addons/TA-DomainController-NT6/bin/powershell has three scripts ad-health.ps1 , ad-repl-stat.ps1 and siteinfo.ps1 . ... View more

I believe that the sessionKey expires according to the splunkd session timeout. ... View more

It's not possible, but you could censor the records into another index using the search command collect before deleting them. ... View more

You don't need three queries, you can do this with a single stats command, assuming you have extracted loginid as a field: sourcetype=my_login_sourcetype | stats count(eval(searchmatch("Success"))) as Logins count(eval(searchmatch("Failed"))) as Failures count(eval(searchmatch("Error"))) as Errors by loginid ... View more

You could indeed work around this using eval: earliest=-10m@m latest=@m *base_search* | addinfo | eval min_time = info_min_time | bucket span=2m info_min_time | eval info_min_time = strftime(info_min_time, "%H:%M:%S")| eval offset = min_time - info_min_time | eval _time=_time-offset | bucket span=2m _time | eval _time=_time+offset| stats xxx by _time This is the search I used for testing my work: sourcetype=access_combined earliest=-9m@m | addinfo | eval orig_time = strftime(_time, "%H:%M:%S")| eval min_time = info_min_time | bucket span=2m info_min_time | eval offset = min_time - info_min_time | eval _time=_time-offset| bucket span=2m _time | eval _time=_time+offset | eval min_time = strftime(min_time, "%H:%M:%S") | eval info_min_time = strftime(info_min_time, "%H:%M:%S")| table min_time info_min_time _time orig_time ... View more

I'd try source=src.txt | transaction startswith="START" endswith="END" ... View more